NSS: Handle unfriendly tokens in client auth.

content/public/browser/resource_context.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_RESOURCE_CONTEXT_H_
 #define CONTENT_PUBLIC_BROWSER_RESOURCE_CONTEXT_H_
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/supports_user_data.h"
@@ skipping 26 matching lines @@
   virtual ~ResourceContext();
 #endif
   virtual net::HostResolver* GetHostResolver() = 0;
 
   // DEPRECATED: This is no longer a valid given isolated apps/sites and
   // storage partitioning. This getter returns the default context associated
   // with a BrowsingContext.
   virtual net::URLRequestContext* GetRequestContext() = 0;
 
   // Get platform ClientCertStore. May return NULL.
-  virtual scoped_ptr<net::ClientCertStore> CreateClientCertStore();
+  virtual scoped_ptr<net::ClientCertStore> CreateClientCertStore(
+      const std::string& host_and_port);

[Ryan Sleevi, 2013/11/25 06:24:34]

I'm really not a fan of threading the host name up to this layer. I think the
goal should be that there's a single ClientCertStore, so that we can centrally
leverage things like platform notifications.

I admit, this is somewhat of a design nit; we could conceivably have a
ClientCertStore creation that, under the hood, used a shared object to
collaborate on things like notifications and caching, but that seems like a
pretty ugly layer of abstraction.

Would it be possible to thread the details of needing the hostname into the
ClientCertStoreNSS, so that we don't have to expose this detail to all CCS
implementations?

I'm not sure whether that would be a bound function / factory object (eg:
instead of SetPasswordDelegate, SetPasswordDelegateFactory) or simply an
interface in the implementation, but that'd avoid introducing the concept of a
"per-host" client cert store.

WDYT?

[mattm, 2013/11/26 01:15:21]

Yeah, I agree that it wasn't the cleanest approach. I've changed to the factory
method as you suggested, PTAL.

 
   // Returns true if microphone access is allowed for |origin|. Used to
   // determine what level of authorization is given to |origin| to access
   // resource metadata.
   virtual bool AllowMicAccess(const GURL& origin) = 0;
 
   // Returns true if web camera access is allowed for |origin|. Used to
   // determine what level of authorization is given to |origin| to access
   // resource metadata.
   virtual bool AllowCameraAccess(const GURL& origin) = 0;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_RESOURCE_CONTEXT_H_